proxmox-mirrors/grub2
1
0
Fork 0
mirror of https://git.proxmox.com/git/grub2 synced 2025-07-21 17:50:15 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

lib/arg: Block repeated short options that require an argument

Browse Source 
Fuzzing found the following crash:

  search -hhhhhhhhhhhhhf

We didn't allocate enough option space for 13 hints because the
allocation code counts the number of discrete arguments (i.e. argc).
However, the shortopt parsing code will happily keep processing
a combination of short options without checking if those short
options require an argument. This means you can easily end writing
past the allocated option space.

This fixes a OOB write which can cause heap corruption.

Fixes: CVE-2021-20225

Reported-by: Daniel Axtens <dja@axtens.net>
Signed-off-by: Daniel Axtens <dja@axtens.net>
Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
This commit is contained in:
Daniel Axtens 2021-01-22 16:07:29 +11:00 committed by Daniel Kiper
parent fe0586347e
commit 2a330dba93
1 changed files with 13 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

13
grub-core/lib/arg.c
View File

@ -299,6 +299,19 @@ grub_arg_parse (grub_extcmd_t cmd, int argc, char **argv,
it can have an argument value. */
if (*curshort)
{
/*
* Only permit further short opts if this one doesn't
* require a value.
*/
if (opt->type != ARG_TYPE_NONE &&
!(opt->flags & GRUB_ARG_OPTION_OPTIONAL))
{
grub_error (GRUB_ERR_BAD_ARGUMENT,
N_("missing mandatory option for `%s'"),
opt->longarg);
goto fail;
}
if (parse_option (cmd, opt, 0, usr) || grub_errno)
goto fail;
}